Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

OpenClaw webhook replay can be bypassed

CVE-2026-41351 · published 6 months ago
Summary

OpenClaw versions before the 2026.3.31 release can be tricked into accepting the same Telnyx webhook more than once by changing the way the signature is encoded. This lets an attacker resend legitimate messages and potentially cause unwanted actions. Update OpenClaw to the latest version to close the bypass.

What to do
  • Update GitHub Actions openclaw to version 2026.3.31.
  • Update openclaw openclaw to version 2026.3.31 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions openclaw < 2026.3.31
Fix: upgrade to 2026.3.31
– openclaw openclaw < 2026.3.31
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Original advisory text
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding
OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests. Attackers can re-encode Telnyx webhook signatures to bypass replay detection while maintaining valid signature verification.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-294Authentication Bypass by Capture-replay
Timeline
Published23 Apr 2026
Updated4 Nov 2026
First seen23 Apr 2026
Sources
CVE-2026-41351 · NVD
GHSA-37v6-fxx8-xjmx · OSV
Track software like this
Free during beta